CVE-2026-23316 | Linux Kernel up to 6.12.76/6.18.16/6.19.6/7.0-rc2 net fib_multipath_hash_from_keys denial of service

VDB-353014 · CVE-2026-23316 · GCVE-0-2026-23316 LINUX KERNEL UP TO 6.12.76/6.18.16/6.19.6/7.0-RC2 NET FIB_MULTIPATH_HASH_FROM_KEYS DENIAL OF SERVICE HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.5 $0-$5k 1.31+ Summaryinfo A vulnerability was found in Linux Kernel up to 6.12.76/6.18.16/6.19.6/7.0-rc2 and classified as critical. This affects the function fib_multipath_hash_from_keys of the component net. Executing a manipulation can lead to denial of service. The identification of this vulnerability is CVE-2026-23316. There is no exploit available. It is suggested to upgrade the affected component. Detailsinfo A vulnerability was found in Linux Kernel up to 6.12.76/6.18.16/6.19.6/7.0-rc2. It has been declared as critical. This vulnerability affects the function fib_multipath_hash_from_keys of the component net. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes: In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix ARM64 alignment fault in multipath hash seed `struct sysctl_fib_multipath_hash_seed` contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with a 4-byte alignment requirement. In `fib_multipath_hash_from_keys()`, the code evaluates the entire struct atomically via `READ_ONCE()`: mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed; While this silently works on GCC by falling back to unaligned regular loads which the ARM64 kernel tolerates, it causes a fatal kernel panic when compiled with Clang and LTO enabled. Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire instructions (`ldar` / `ldapr`) to prevent compiler reordering bugs under Clang LTO. Since the macro evaluates the full 8-byte struct, Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly requires `ldar` to be naturally aligned, thus executing it on a 4-byte aligned address triggers a strict Alignment Fault (FSC = 0x21). Fix the read side by moving the `READ_ONCE()` directly to the `u32` member, which emits a safe 32-bit `ldar Wn`. Furthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire struct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis shows that Clang splits this 8-byte write into two separate 32-bit `str` instructions. While this avoids an alignment fault, it destroys atomicity and exposes a tear-write vulnerability. Fix this by explicitly splitting the write into two 32-bit `WRITE_ONCE()` operations. Finally, add the missing `READ_ONCE()` when reading `user_seed` in `proc_fib_multipath_hash_seed()` to ensure proper pairing and concurrency safety. The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-23316 since 01/13/2026. Technical details are known, but there is no available exploit. Upgrading to version 6.12.77, 6.18.17, 6.19.7 or 7.0-rc3 eliminates this vulnerability. Applying the patch 4bdc94d45d5459f0149085dfc1efe733c8e14f11/7e4ad34a8889a6a9e0f6cc7c55d02161fe31a199/607e923a3c1b2120de430b3dcde25ed8ad213c0a/4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version. Productinfo Type Operating System Vendor Linux Name Kernel Version 6.12.0 6.12.1 6.12.2 6.12.3 6.12.4 6.12.5 6.12.6 6.12.7 6.12.8 6.12.9 6.12.10 6.12.11 6.12.12 6.12.13 6.12.14 6.12.15 6.12.16 6.12.17 6.12.18 6.12.19 6.12.20 6.12.21 6.12.22 6.12.23 6.12.24 6.12.25 6.12.26 6.12.27 6.12.28 6.12.29 6.12.30 6.12.31 6.12.32 6.12.33 6.12.34 6.12.35 6.12.36 6.12.37 6.12.38 6.12.39 6.12.40 6.12.41 6.12.42 6.12.43 6.12.44 6.12.45 6.12.46 6.12.47 6.12.48 6.12.49 6.12.50 6.12.51 6.12.52 6.12.53 6.12.54 6.12.55 6.12.56 6.12.57 6.12.58 6.12.59 6.12.60 6.12.61 6.12.62 6.12.63 6.12.64 6.12.65 6.12.66 6.12.67 6.12.68 6.12.69 6.12.70 6.12.71 6.12.72 6.12.73 6.12.74 6.12.75 6.12.76 6.18.0 6.18.1 6.18.2 6.18.3 6.18.4 6.18.5 6.18.6 6.18.7 6.18.8 6.18.9 6.18.10 6.18.11 6.18.12 6.18.13 6.18.14 6.18.15 6.18.16 6.19.0 6.19.1 6.19.2 6.19.3 6.19.4 6.19.5 6.19.6 7.0-rc1 7.0-rc2 License open-source Website Vendor: https://www.kernel.org/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 5.7 VulDB Meta Temp Score: 5.5 VulDB Base Score: 5.7 VulDB Temp Score: 5.5 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Denial of service CWE: CWE-404 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Partially Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: Kernel 6.12.77/6.18.17/6.19.7/7.0-rc3 Patch: 4bdc94d45d5459f0149085dfc1efe733c8e14f11/7e4ad34a8889a6a9e0f6cc7c55d02161fe31a199/607e923a3c1b2120de430b3dcde25ed8ad213c0a/4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f Timelineinfo 01/13/2026 CVE reserved 03/25/2026 +71 days Advisory disclosed 03/25/2026 +0 days VulDB entry created 03/25/2026 +0 days VulDB entry last update Sourcesinfo Vendor: kernel.org Advisory: git.kernel.org Status: Confirmed CVE: CVE-2026-23316 (🔒) GCVE (CVE): GCVE-0-2026-23316 GCVE (VulDB): GCVE-100-353014 Entryinfo Created: 03/25/2026 12:48 Changes: 03/25/2026 12:48 (59) Complete: 🔍 Cache ID: 99:D6E:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸